[exelist] Re: new ASPack

[mr_stranger@...]

> Such "new" Aspack has some tricks that make unpacking "a little" different
> (not harder).
> In any case,  the last step (assembly instruction) of the loader is always
> at <Loader_RVA + 8F> .  Put a breakpoint on it (the loader is usually the
> .adata object) and read EAX register.  Such value will be the original
> EntryPoint.  
> 
> Use Procdump in order to Full Dump the running process (set Options to
> "Rebuild New Import Table").  Then use any hex editor (or better, the
> built-in ProcDump Pe Editor) to change the Entry_Point_Rva.
> 
> btw...the Ieye file original EntryPointRva is 22960h ;)

Thanks!!! It orks!


------------------------------------------------------------------------
eGroup home: http://www.eGroups.com/group/exelist
http://www.eGroups.com - Simplifying group communications